If AGI Is Cheap Intelligent Labor, Cyber Defense Should Become Continuous Forensics

When Jaguar was hit by ransomware, Carlier recalls, operations were down for a month or two and the company needed a $2 billion loan from the UK government to avoid going under. That is the economic punch of a moderately sophisticated crime gang: encrypt the systems, put a payment notice on the screen, and wait. It is also the kind of story that makes cybersecurity feel like a parade of disasters rather than a design problem.

Alexis Carlier is founder and CEO of Asymmetric Security, which had just come out of stealth when he sat down with Cognitive Revolution host Nathan Labenz. Anthropic red-team lead Logan Graham had replied to the launch by calling him one of the most "AGI-pilled" people in the space. Carlier takes the label as a career pattern. In 2020 and 2021, before ChatGPT, he was on the early team at the Center for the Governance of AI, trying to think through what would happen if AI became a very big deal when almost nobody else was doing that professionally.

Asymmetric is the same bet applied to defense. Assume something like AGI will exist — not today's jagged tools, but drop-in remote workers that fully substitute for long-horizon human work — and then ask what cyber defense should look like. That, he says, takes you somewhere most security companies do not go. If the AGI assumption is wrong, the company is still valuable; it is just worth much less. The design answer he is building toward is a shift from reactive emergency triage to proactive, continuous digital forensics.

Carlier's map of the threat landscape starts with volume. Roughly 80 percent of attacks, he estimates, come from relatively unsophisticated amateurs or criminals. They are financially motivated, they spray phishing emails at as many targets as possible, and they reuse other people's malware — "script kiddies" hoping something works. For an ordinary person without crown-jewel IP, that is probably the threat that actually shows up. Do not click the phishing email, he says, and you are probably fine.

In the middle sit organized ransomware crews: moderately sophisticated, coordinated, and economically the most damaging. They get into systems, encrypt everything, and demand money. The tactic popped during COVID. A local medical system Labenz knows was taking notes on paper for the same reason. The damage-to-ransom ratio is incredibly negative-sum; Carlier thinks on the order of 10 to 1 sounds right, and he has heard economists argue that ending the scourge would show up in growth statistics.

Nation-states are a small share of volume and a different sport. China, he says, focuses on IP theft from Western R&D-heavy industries, with AI now almost definitely a huge target. Russia leans toward political disruption — the 2016 U.S. election is the famous case. North Korea is trying to fund the regime. One method is a remote-worker program that places North Korean operators in foreign tech jobs. Asymmetric had just hired someone from CrowdStrike who works those cases: companies notice an employee is both sending money home and sending bits of IP. Labenz jokes about getting the Brex or Ramp card as fast as possible. The behavioral contrast matters for detection. Once ransomware crews encrypt, they want to be found. Nation-states want to stay stealthy as long as they can.

By volume, most attacks are social engineering or phishing — Carlier ballparks 70 to 80 percent — because attackers take the path of least resistance and will not burn a valuable zero-day if a convincing email will do. Most technical risk, he adds, still comes from known, unpatched issues. Zero-days are rarer and tend to be used by the most sophisticated actors, but they get more press than their share of everyday attacks.

What works depends on who is coming for you. For people who are not nation-state targets or big ransomware marks, MFA, regular software updates, vendor supply-chain checks, some automated monitoring, and occasional compromise assessments go a long way against amateurs and some organized crime. Against determined nation-states, he says it is extremely difficult. You would severely limit software and hardware providers — you probably could not use most SaaS — vet employees in ways that are outside the norm and plausibly illegal in some places, hunt zero-days in your own systems, and run compromise assessments constantly. Most organizations are not there, which is why he thinks most nation-states have ongoing IP-theft operations.

Labenz had been advised not to take his devices to China for an AI-safety dialogue: burner phones, throw them away on return, do not log in. Carlier says that if you skip that, you should expect people to read your communications on an ongoing basis, especially with a public profile. The architecture is persistence, not a local-network window: a physical implant or stolen credentials that travel home with the device. Apple's security is generally pretty good, he adds, but estimates of CCP offensive effort run to hundreds of thousands of people, and some nation-state access was not discovered publicly until decades later. Ordinary people are not high on the priority list, so they may not spend a zero-day they expect to be caught using. Capability is not the same as priority.

AI has not yet transformed either side of this landscape, Carlier says. Phishing can be automated, but there has not been a huge offensive uplift. Lab measurements suggest models are on the precipice of those capabilities, which he expects will mainly lower the sophistication threshold — more people able to run moderately complex attacks such as ransomware. Defense has not been transformative yet either. That is the gap Asymmetric is trying to occupy.

Measuring any of this is unusually hard. Unlike software engineering, most cybersecurity is not public. When a company is hacked, it does not publish the email logs. Carlier has talked to people at frontier labs for whom that missing benchmark is a bottleneck. You also need subject-matter experts who are themselves excellent, and there are not many. CrowdStrike, one of the top incident-response firms in the world, has a team of roughly 60 people who can do deep forensic investigations. Talent is scarce, data is scarce, and by default it is very hard to know how good the models are.

What enterprises actually run is static-rule detection: software that hardcodes what looks suspicious. Login from a new place, stay up late, download files in bulk — all of that can be a trip to Tibet or a normal crunch week. Meanwhile a careful thief can exfiltrate tiny amounts over months and never trip a rule. The security operations center triages a flood of alerts, asks which ones are worth prioritizing, and only in a minority of cases pulls a case into digital forensics: detective work over every evidence source. That method is the most accurate one we have. It is also bottlenecked on expensive, slow people, so it is used mostly after a breach. Carlier's better question is not "which human workflow should I automate" but "what would you do with 100x the intelligent labor." Work that was too slow and too expensive can run at scale. In the limit, deep investigation could cost about as much as compute and run nearly continuously.

Asymmetric's wedge is business email compromise: attacks that start from an inbox. An attacker phishes or steals credentials, then uses the mailbox to trick people into sending information or money. The DNC hack by Russia in 2016 was an email-based attack. Investigators pull logs from Microsoft or Google tenants, reconstruct how access was obtained, whether it was escalated, what was read, sent, or deleted, whether inbox rules auto-forwarded or auto-deleted mail, whether Drive files were touched, and whether the attacker is still inside. The sequence is clear; the pivoting is human. A weird login location, or a user in two places at once, is a thread you follow.

Tenants actually do have the logs you need once you have admin access. The provider still matters. Carlier says there are far fewer Google email compromises than Microsoft ones, at least an order of magnitude, for a configuration gap he finds baffling and that Microsoft has not closed. Some people he knows considered building in this space and decided not to, on the theory that Microsoft would solve it one day. So far it has not.

The company is a full-stack AI digital-forensics and incident-response shop whose mission is to accelerate AI cyber defense by automating forensics as fast as possible. A platform ingests the logs. An agent does a first-pass analysis. Human investigators mostly quality-check the reasoning and, in a minority of cases, change it. Email investigations are on the simpler end, and without fancy training you can get on the order of 90 percent accuracy out of the box. That speeds the work. It is totally insufficient to automate it. Reliability's extra nines matter, so humans stay in the loop for the foreseeable future, especially as investigations get more open-ended. The practical result so far is shrinking typical response from two days to a week down to a few hours.

Labenz puts the IBM problem on the table: nobody got fired for going with CrowdStrike, so how does a young company win enough cases to start a data flywheel? Carlier's answer is CrowdStrike's own history. About fifteen years ago it began as an incident-response service provider and only productized a couple of years later. Services solved two problems at once: they showed what attackers were doing in the wild, and they built trust with enterprises. In cybersecurity, trust is the distribution channel, because you often cannot tell whether a tool is working or whether you simply have not noticed the breach. HR software either pays people on time or it does not. Security is a faith-based purchase until it fails.

What is new is that AI-enabled services can now run at much better margins. That, Carlier thinks, is the opening. Compressing email investigations from days to hours is proving compelling enough to earn initial trust, from which other case types can follow. Incumbents are not adopting as quickly. Some of that is billing by the hour. Some of it is scale: incident-response services are about a $40 billion market, while he recalls CrowdStrike as close to a $200 billion company whose majority revenue comes from detection products, not forensics. The services pie looks like small fish unless you believe forensics will eventually change how detection itself works.

That belief is the AGI-pilled part. Most security people, he says, are skeptical by nature and do not really believe in AI in this large way. He has spoken with people at the intersection of AI and security and thinks the opportunity is partly just having thought through the implications. Distribution, meanwhile, runs through an unusual channel: cybersecurity insurers. Carriers keep a pre-approved panel of incident-response vendors for when insureds get hacked. A lot of the sales motion is meeting those carriers, building trust there, and only then meeting the enterprise.

Carlier does not think AGI is here. What he has in mind is a drop-in remote worker that can fully substitute for long-horizon human work. Today's models are a jagged frontier: genius at some tasks, unable to string work together over long enough horizons, which is why they can look superhuman and still barely show up in economic output. He sides with the Karpathy-style diagnosis that reinforcement learning on verifiable rewards is concentrating gains in coding and math. Until another paradigm arrives, he does not expect them to get great at poetry for quite a while. Jaggedness is not only a limitation. It is a steering wheel.

Alignment researchers have long talked about an automated AI researcher as a way to accelerate alignment. Other fields rarely think that way, in part because pre-training generalized so strongly that it was hard to speed up one direction on purpose. Jaggedness changes that. If you are a subject-matter expert, you can curate datasets, environments, and evals and pull the frontier toward defensive cybersecurity, biodefense, or pieces of AI safety. Very few people are doing it. In cyber, the usual objection is dual use. Carlier thinks that is overstated. Pentesting and vulnerability discovery really are dual-use: you can patch a hole or exploit it. Sam Altman had tweeted in that vein. Digital forensics is different. It asks whether there is evidence of attackers in a system, not whether you can break in.

At the human level, the skill sets barely overlap. Forensics is a distinct community from offensive white-hat hacking, which surprised Labenz, who expected incident responders to be pretty good at breaking in. Carlier says they are not, and he suspects models will behave the same way until continual learning makes everything good across the board. That window is the chance to differentially accelerate defense. Offensive security can just try to hack things all the time without sensitive data. Defense cannot. Asymmetric's attempt is to staff investigations with people from CrowdStrike, Palo Alto Networks, and other large firms, let them work with the AI tooling, and turn those traces into high-fidelity evals and training environments. Default, he thinks, is that model providers and big cyber incumbents lag on this because they lack the incentive. He would like many more companies trying to solve the data-and-eval problem, not just his.

Labenz's usual joke is that dentistry has no latent demand — cheaper fillings do not make him want more — while massages might be daily if they were nearly free. Carlier splits his market the same way. Applied only reactively, after a breach, incident response is not a category where people would buy more if they could. You are bleeding and you need it stopped. AI-enabled attacks may grow that demand, but it is still an emergency purchase.

If the same investigative reasoning is applied proactively, it starts to substitute for today's static-rule detection, a much bigger market he puts on the order of a few hundred billion, maybe $500 billion. That is the minimum: replace existing detection. On top of that is an open question. If high-quality security becomes extremely cheap, who wants more of it? Some organizations only need to meet a minimum bar. AI labs protecting model weights, and national-security agencies, have a much higher demand. Those are the buyers he expects to pull additional volume beyond substitution.

He is not counting on perfect outer hardening to make forensics obsolete. Formal methods that train models to write secure code would be great, and people should do that work, but he would be very surprised if it were sufficient. Nation-state defense is not just "no code vulnerabilities," other ways in remain, and the strong assumption should be that stuff gets in. Extreme hardening also trades off against productivity — an AI lab that restricts how people interact with model weights to block exfiltration is safer and more annoying. Automated forensics can run in the background without that tax. Hardening and detection substitute for a given security level and complement each other in making you more secure. Full impenetrability, in his mind, is not realistic.

On models versus harness versus data, Carlier wants the low-hanging fruit first: try frontier systems, build a minimal scaffold, stand up evals that actually tell you what is working, and only then consider training specialist weights. For the simple email incidents they handle now, off-the-shelf models plus scaffold already go pretty far. He is unsure how much extra effort those specific attacks are worth. On more open-ended, long-horizon incidents he would be shocked if today's models were anywhere near as good. That is where differentiated access to real cases, used as blueprints for evals, and analysts' reasoning traces on the platform become the asset.

Whether to license that asset back to model developers or keep it in-house is still open. Sharing evals — not the delicate raw incident data — could improve foundation models at tasks that then deploy, immediately, across AI labs and governments, with large contracts attached. Seeing live incidents all the time is more differentiated than a generic data vendor. It might also give away something proprietary. He can imagine iterating: share some past work, keep the next layer. The mission case for sharing the evaluations is, in his view, significant.

Zoomed out, he wants fully automated digital forensics much sooner than it would arrive by default, bootstrapped with humans and realistic evals, then left running on systems so fewer breaches go undetected. The hopeful retrospective is that when people look back at AI's effect on cybersecurity, they conclude it was overwhelmingly beneficial for defenders — deployed across labs, the AI supply chain, Western governments, even safeguards around autonomous weapons. That outcome is possible and, he thinks, tractable. It does not require a leap of imagination. It does require many more projects that pull the jagged frontier toward defense, in cyber, in biosecurity, wherever a defensive specialty can be turned into data, evals, and environments. Labenz says he might even change some of those reused passwords.